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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 

WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
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Status 

1 )E3 Responsive to communication(s) filed on 28 March 2007 . 
2a)K This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) E3 Claim(s) 1-26 is/are pending in the application. 

4a) Of the above claim(s) r is/are withdrawn from consideration. 

5) Q Claim(s) is/are allowed. 

6) G3 Claim(s) 1-26 is/are rejected. 
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8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)Q The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
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application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1 . This office action is in reply to an amendment filed on March 28, 2007. Claims 1-3, 10, 
13, 18-22 have been amended and new claims 23-26 have been added. Claims 1-26 are 
pending. 

Response to Arguments 

2. Applicant's arguments filed March 28, 2007 have been considered but are moot in view 
of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 1-26 are rejected under 35 U.S.C. 103(a) as being unpatentable over EP 0 992 
873 A2 Hashimoto et al. (hereinafter Hashimoto) in view of Griffin et al. US 2002/01781 19 A1 
(hereinafter Griiffin) [submitted with IDS filed on 03/28/07]. 

5. As per claims 1 and 18, Hashimoto teaches a computer-implemented method for 
generating access control information, the method comprising: 

receiving an access control rule that identifies a characteristic (i.e., access-right setting 
pattern list) [column 7, lines 48-56 and figure 3]; 
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identifying at least one entry in user information that is associated with the identified 
characteristic [column 8, lines 10-19]; 

identifying at least one entry in data object (i.e., content) information that is associated 
with the identified characteristic [column 7, lines 56-column 8, lines 10]; and 

generating access control information that permits at least one user associated with the 
at least one entry in the user information to access the at least one entry in the data object 
information [column 8, lines 20-49], Hashimoto is silent on programmatically identifying entry in 
user'and object information. However, Griffin teaches a role based access control system, 
including programmatically identifying at least on entry in user information that is associated 
with an identified characteristic and programmatically identifying at least one entry in data object 
information that is associated with an identified characteristic (i.e., in an automatic manner using 
a software program, see Griffin, paragraphs 0010, 0061-0063). It would have been obvious to 
one having ordinary skill in the art at the time of applicant's invention to employ the teachings of 
Griffin within the system of Hashimoto in order to enhance the efficiency of the system by 
performing database/access control updates automatically. 

6. As per claim 10, Hashimoto teaches a computer system for managing access control 
information for software operating on the computer system, the system comprising: 

a data repository for access control information for software, the data repository 
including user information identifying a user characteristic for at least one entry in the user 
information [column 8, lines 10-19], data object information identifying a data object 
characteristic for at least one entry in the data object information [column 7, lines 56-column 8, 
lines 10], and access control rule information identifying a shared characteristic for at least one 
entry in the access control rule information [column 8, lines 20-49]; and 
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an executable software module that causes (1) a comparison of the user characteristic, 
the business object characteristic, and the shared characteristic and (2) generation of access 
control information for use in determining whether a user that is associated with an entry in the 
user information is permitted to access a data object that is associated with an entry in the data 
object information such that when the user characteristic, the data object characteristic and the 
shared characteristic each correspond to one another, the user is permitted to access the data 
object [column 8, lines 43-column 9, lines 7]. 

generating access control information that permits at least one user associated with the 
at least one entry in the user information to access the at least one entry in the data object 
information [column 8, lines 20-49]. 

Hashimoto is silent on a programmatic comparison of the user characteristic as cited in 
the claim. However, Griffin teaches a role based access control system including, programmatic 
comparison of a user characteristic, a data object characteristic and a shared characteristic (i.e., 
group object) indicating that the user characteristic correspond to the shared characteristic and 
the data object characteristic corresponds to the shared characteristic [Griffin, paragraphs 0030, 
0061-0063], and generating access control information that prevents the user associated with 
the entry in the user information from accessing the data object condition on programmatic 
comparison of the user characteristic, the data object characteristic and the shared 
characteristic indicating that the user characteristic does not correspond to the shared 
characteristic or the data object characteristic does not correspond to the shared characteristic 
[paragraphs 0061-0063]. It would have been obvious to one having ordinary skill in the art at the 
time of applicant's invention to employ the teachings of Griffin within the system of Hashimoto in 
order to enhance the efficiency of the system by performing database/access control updates 
automatically. 
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7. As per claims 2 and 11-12, Hashimoto further teaches the method wherein, the identified 
characteristic is indirectly associated with the at least one entry in the user information, and 
identifying at least one entry in user information that is associated with the identified 
characteristic comprises identifying at least one entry in user information that is indirectly 
associated with the identified characteristic [column 8, lines 10-19 and figure 3-5]. Griffin further 
teaches programmatically identifying at least one entry [paragraphs 0061-0063]. 

8. As per claim 3, Hashimoto further teaches the method wherein, the identified 
characteristic is directly associated with the at least one entry in the user information, and 
identifying at least one entry in user information that is associated with the identified 
characteristic comprises identifying at least one entry in user, information that is directly 
associated with the identified characteristic [column 8, lines 10-19 and figure 3-5]. Griffin further 
teaches programmatically identifying at least one entry [paragraphs 0061-0063]. 

9. As per claims 4-7 and 13-17, Hashimoto further teaches the method wherein, generating 
access control information comprises: generating/storing user access control information that 
identifies the at least one entry in the user information that is associated with the identified 
characteristic, generating object access control information that identifies the at least one entry 
in the data object information that is associated with the identified characteristic, and associating 
at least one entry in the user access control information with at least one entry in the data object 
access control information [column 8, lines 20-49]. 
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10. As per claims 8, 9, 21 and 22, Hashimoto further teaches the method further comprising 
receiving a filter condition, wherein generating access control information further comprises 
generating access control information by eliminating at least one entry in the user 
information/data object information that corresponds to the received filter condition such that 
access control information does not include the eliminated at least one entry in the user data 
object information [column 8, lines 5-39]. 

11. As per claims 1 9 and 20, Hashimoto further teaches the method wherein the one or 
more code segments configured to generate access control information comprise one or more 
code segments configured to: generate user access control information that identifies the at 
least one entry in the user information that is associated with the identified characteristic, 
generate object access control information that identifies the at least one entry in the data object 
information that is associated with the identified characteristic, and associate at least one entry 
in the user access control information with at least one entry in the data object access control 
information [column 8, lines 5-36]. 

12. As per claim 23, Griffin further teaches the method wherein programmatically identifying 
at least one entry in user information that is associated with the identified characteristic, 
programmatically identifying at least one entry in data object information that is associated with 
the identified characteristic, and generating access control information that permits at least one 
user associated with the at least one entry in the user information to access the at least one 
entry in the data object information occurs automatically without human intervention [paragraph 
0030]. 
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13. As per claims 24-26, Griffin further teaches the method wherein programmatically 
identifying at least one entry in user information that is associated with the identified 
characteristic comprises: programmatically identifying a first entry in user information that is 
associated with the identified characteristic, and programmatically identifying a second entry in 
user information that is associated with the identified characteristic, the first entry being 
associated with a first user the second entry being associated with a second user that is 
different than the first user, programmatically identifying at least one entry in data object 
information that is associated with the identified characteristic comprises programmatically 
identifying a first data object in data object information that is associated with the identified 
characteristic and generating access control information that permits at least one user 
associated with the at least one entry in the user information to access the at least one entry in 
the data object information comprises generating access control rule information that enables 
the first user to access the first data object and the second user to access first data object 
[paragraphs 0060-0063]. 

Conclusion 

14. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
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CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571) 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Beemnet Dada 
June 10, 2007 
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